Ley 1581 de 2012, Data Subject Rights and Procedures

Ley 1581 de 2012, arts. 8, 12, 14-16 (Derechos de los Titulares)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 17 October 2012.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Give a data subject the right to know, update and rectify their personal data, request proof of the authorization given, be told on request how their data has been used, revoke the authorization or seek deletion where the processing violates their constitutional or statutory rights, and access their personal data free of charge.
Before requesting a data subject's authorization, tell them clearly and expressly the purpose of the processing, that answering a question about sensitive data or a minor's data is optional, their rights as a data subject, and how to identify and contact you, and keep proof that you gave this notice.
Answer a data subject's request to consult their personal data within ten business days, or tell them the reason for delay and a new date no more than five business days later.
Mark the record with a pending claim legend within two business days of receiving a complete claim for correction, updating or deletion, and resolve the claim within fifteen business days, or fifteen days extendable by eight more days with notice of the delay and a new resolution date.
Expect a data subject to complain to the Superintendencia de Industria y Comercio only after they have exhausted the consultation or claim procedure with you.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 8 gives every data subject the right to know, update and rectify their personal data before the controller or processor, request proof of the authorization given, be told on request how their data has been used, file a complaint with the Superintendencia de Industria y Comercio, revoke the authorization or seek deletion of the data where the processing does not respect their constitutional or statutory rights, and access their personal data free of charge.

Article 12 requires the controller, at the moment of requesting authorization, to tell the data subject clearly and expressly the purpose of the processing, that answering a question about sensitive data or a minor's data is optional, the rights the data subject holds, and the controller's identification and contact details, and to keep proof that this notice was given.

Article 14 gives the data subject or their successors the right to consult their personal data held in any public or private database, to be answered within ten business days, extendable by five more business days with notice of the delay and a new date.

Article 15 gives the right to lodge a claim for correction, updating or deletion, or over a suspected breach of any duty this law imposes, requires a pending claim legend to be added to the record within two business days of a complete claim, and sets fifteen business days to resolve it, extendable by eight more with notice of the delay and a new date.

Article 16 conditions a complaint to the Superintendencia de Industria y Comercio on having first exhausted the consultation or claim procedure before the controller or processor.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

Official consolidated text, Gestor Normativo, Departamento Administrativo de la Funcion Publica

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app